Nmap (network Mapper)

Nmap Commands for Linux:

The Nmap ( Network Mapper ) is an open source and a very versatile tool for Linux system/network administrators. It is a security tool for network exploration, security scanning and auditing.

Nmap security tool scans for Live hosts, Operating systems, packet filters and open ports running on remote hosts.

Significant effort has been put into decent nmap performance  for  non- root  users.   Unfortunately,  many critical kernel interfaces (such as raw sockets) require root privileges.  nmap should be run as root when-ever possible (not setuid root, of course).

The Nmap command syntax is:

                         # nmap [Scan Type(s)] [Options] {target specification}

How To install Nmap :

To install Nmap on distribution specific use the following command.

                        # yum install nmap

1. Scan using IP Address:

 #nmap 192.168.0.0/24

 Starting Nmap 5.21 ( http://nmap.org ) at 2014-09-18 11:44 EST

 Nmap scan report for 192.168.0.1

 Host is up (0.0043s latency).

 Not shown: 998 closed ports

 PORT STATE SERVICE

 80/tcp open http

 443/tcp open https

2. Scan using “-v” command:

# nmap -v 192.168.0.1

Starting Nmap 4.11 ( http://nmap.org/ ) at 2014-06-14 15:43 EST

Initiating ARP Ping Scan against 192.168.0.1 [1 port] at 15:43

The ARP Ping Scan took 0.01s to scan 1 total hosts.

Initiating SYN Stealth Scan against server2.tecmint.com (192.168.0.1) [1680 ports] at 15:43

Discovered open port 22/tcp on 192.168.0.1

Discovered open port 80/tcp on 192.168.0.1

The SYN Stealth Scan took 0.30s to scan 1680 total ports.

Host server2.tecmint.com (192.168.0.1) appears to be up ... good.

Interesting ports on server2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds

               Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

3. Scan a whole Subnet:

[root@server1 ~]# nmap 192.168.0.*

Starting Nmap 4.11 ( http://nmap.org ) at 2013-11-11 16:11 EST

Interesting ports on test1.example.com (192.168.0.1):

Not shown: 1677 closed ports

PORT    STATE SERVICE

22/tcp  open  ssh

111/tcp open  rpcbind

851/tcp open  unknown

Interesting ports on test2.example.com (192.168.0.2):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.550 seconds

You have new mail in /var/spool/mail/root

4. Scan a Host to check its protected by Firewall:

To scan a host if it is protected by any packet filtering software or Firewalls.

[root@server1 ~]# nmap -PN 192.168.0.1

Starting Nmap 4.11 ( http://nmap.org ) at 2013-11-11 16:30 EST

Interesting ports on test2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

Nmap finished: 1 IP address (1 host up) scanned in 0.399 seconds

5. Enable OS Detection with Nmap:

Use the option “-O” and “-osscan-guess” also helps to discover OS information.

[root@test1 ~]# nmap -O server2.tecmint.com

Starting Nmap 4.11 ( http://nmap.org ) at 2014-11-11 17:40 EST

Interesting ports on server2.tecmint.com (192.168.0.1):

Not shown: 1674 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

111/tcp  open  rpcbind

No exact OS matches for host (If you know what OS is running on it, see http://nmao.org).

TCP/IP fingerprint:

SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52815CF4%O=22%C=1%M=080027)

TSeq(Class=TR%IPID=Z%TS=1000HZ)

T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)

T2(Resp=N)

T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)

T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=Option -O and -osscan-guess also helps to discover OS

R%Ops=)

T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)

T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)

T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)

PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Uptime 0.221 days (since Mon Nov 11 12:22:16 2014)

Nmap finished: 1 IP address (1 host up) scanned in 11.064 seconds

You have new mail in /var/spool/mail/root

6. Find Nmap version:

[root@server1 ~]# nmap -V

Nmap version 4.11 ( http://nmap.org )

You have new mail in /var/spool/mail/root